fix(auth): memoize resolve_nous_access_token to collapse startup burst (salvage #66016)

[kshitijk4poor]

Salvages #66016 by @JeffStone69 — commit cherry-picked to preserve authorship, plus one follow-up commit (fast-path memoization + tests).

Context — what this fixes, for whom

Every startup, check_tool_availability runs one check_fn per managed tool (browser, image_gen, video_gen, tts, stt, ...), and each independently calls resolve_nous_access_token(). Every call pays two cross-process file locks + state-file reads — and when the stored token is expired, each triggers its own ~15s blocking OAuth refresh round-trip. On slow/constrained hosts that serial burst stretches startup to minutes.

What the fix does (from #66016, kept verbatim)

Adds a 5s-TTL, thread-safe, per-process memo to resolve_nous_access_token(): the first call resolves, subsequent calls within the TTL return the cached token. Correctly scoped — only the default path is cached; insecure/ca_bundle callers bypass entirely; failed refreshes never populate it. Follows the established nous_billing.py 30s-cache precedent.

Follow-up commit (ours)

1. Memoize the valid-token fast path too. The original memo only populated after a refresh — but the startup burst usually finds a valid token, and that return path still paid the full lock/read cost per check_fn. The token has ≥refresh_skew_seconds (120s) of life at that return, so a 5s memo can never serve an expired token.
2. Test-suite adaptation: test_nous_portal_staging_allowlist.py's refresh-capture tests now clear the module-level memo first (with the fast-path populate, cross-test memo pollution made 3 of them fail — caught during review).
3. Memo behavior tests (the PR shipped none): TTL hit collapses to one state transaction, TTL expiry re-resolves, insecure bypass. Mutation-checked: all 3 fail against main's un-memoized function.

Verification

• tests/hermes_cli/test_resolve_token_memo.py + test_nous_portal_staging_allowlist.py: 7 passed; broader auth suites (test_nous_account, test_auth_profile_fallback, test_managed_tool_gateway): 42 passed
• ruff clean; thundering-herd note: two threads racing a cold memo can still both refresh (lock isn't held across the network call — correct, holding it would serialize a 15s call); the burst is serial in practice so the memo collapses it fully

Closes #66016 (superseded by this salvage — original author credited via cherry-pick authorship).